IoCs in Phishing Campaigns: A Focus on Support Chat Keys

March 21, 2024


Phishing campaigns are a persistent threat to cybersecurity, with malicious actors constantly refining their tactics to exploit vulnerabilities. One emerging trend in these campaigns is the misuse of support chat keys, such as those provided by services like and Initially designed to enhance customer support, these services can inadvertently become Indicators of Compromise (IoCs) when used maliciously.

Understanding IoCs

Indicators of Compromise (IoCs) are artifacts observed in a network or system that indicate a security breach or intrusion has occurred. They can be as diverse as unusual network traffic patterns, suspicious IP addresses, or in this case, support chat keys embedded in phishing websites.

Support Chat Keys as IoCs

Support chat keys are unique identifiers used by chat services to connect users to the correct support team. In a phishing context, threat actors embed these keys into fake websites to create an illusion of legitimacy. These keys can serve as IoCs, helping cybersecurity professionals detect and respond to phishing attempts. and are popular chat services that provide free live chat widgets for websites. However, their popularity has also made them attractive tools for phishing campaigns.

Phishing websites can employ services like or to replicate the live chat function often found on legitimate sites. To enable chat and establish a connection to the intended support service, a webmaster must incorporate a JavaScript script containing specific public keys into their site. However, in a phishing context, these keys are not linked to the support service of a genuine organization but to a malicious team. The presence of a familiar support chat interface, similar to those found on reputable sites, can instill a false sense of trust in unsuspecting users. Moreover, as malicious actors have access to all messages from these chat rooms and may even respond, the possibility of users inadvertently divulging sensitive data to "support agents" cannot be discounted.

Support Chat Keys as IoCs

Detecting Such IoCs

The detection of such keys is relatively straightforward, as they are present both within the HTML code of a website and in HTTP requests. This dual presence facilitates their discovery, whether through static analysis of a site or dynamic analysis of network traffic.

Detecting IoCs 1 Detecting IoCs 2

In the case of the malicious site hxxps:// employs the service with the unique key "65ce2bd39131ed19d96d22a9/1hmmlmcl5". By utilizing the service and conducting a search with the query "filename: 1hmmlmcl5", we were able to identify 177 pages hosted on various subdomains of, a domain owned by Microsoft Azure. Despite these pages featuring different templates, the presence of the same IoC suggests they are likely operated by the same threat actor. Without this IoC, associating these disparate sites would have been challenging. Furthermore, our investigation revealed phishing sites impersonating KuCoin, Bitstamp,, WalletConnect, Exodus Wallet, and Coinbase, all tied to the same IoC.

Detecting IoCs 3

Responding to Such IoCs

Upon detection of malicious use of support chat keys, it is crucial to report the abuse to the respective chat service providers. Both and smartsuppchat provide dedicated pages for reporting such misuse.

For, the abuse reporting page can be found at This page provides a form where you can submit details about the abuse, including the unique key associated with the malicious site. Abuse Reporting

Similarly, smartsuppchat offers an abuse reporting page at Here, you can report phishing or scam activities that misuse their service.

Smartsupp Abuse Reporting

By reporting such abuses, you contribute to the collective effort of maintaining a safer digital environment. The service providers can then take necessary actions, such as disabling the malicious keys, preventing further misuse, and potentially assisting in the identification of the threat actors.


As phishing campaigns continue to evolve, so too must our approach to cybersecurity. By understanding how support chat keys can serve as IoCs, we can better detect and respond to these threats, protecting our data from potential compromise. It's a reminder that even the most innocuous-seeming features can be exploited, and vigilance is our best defense.